• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
Scott Isaacs Presentationajaxexperience (Final)
 

Scott Isaacs Presentationajaxexperience (Final)

on

  • 1,921 views

 

Statistics

Views

Total Views
1,921
Views on SlideShare
1,921
Embed Views
0

Actions

Likes
1
Downloads
29
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment
  • Users view versus reality… Start with your site and then expand… explaining the user’s view versus what is really happening
  • Platforms - cloud data is avaluable – same attack vectors against the PC now exist in the cloud. Currently hacking around for sharing. data
  • Quality of service demo, code throttling., etcUse TICKING CLOCK!
  • Request untrusted contentTransform untrusted contentInterceptionProfilingQoS ProtectionWrap a sandbox around contentAssociate with PolicyBind to document node (optional)Execute…
  • JSON-ize HTML/CSS, Inject interception, profiling, QoS hooks, and Lifecycle (factory) supportPerforms an A->B TransformationPerforms syntactic validationNo security at this point
  • DO A DEMO OF A POLICY EXPLAINING DOCUMENT.BODYDo prototype overriding and namespace explanationaddEventListener…
  • Some scenarios are so extreme, becoming a platform themselveLocal capabilities are being exposed, cloud Capabilities are increasing in valueBe aware of these challenges in your applications…

Scott Isaacs Presentationajaxexperience (Final) Scott Isaacs Presentationajaxexperience (Final) Presentation Transcript

  • Beyond IFrames:Web Sandboxes
    Scott Isaacs
    Software Architect
    Microsoft
  • How Web Sites are Built Today
    Google Friend Connect
    Youtube
    The Web normally has a Same Origin Policy – but in practice, “your script works in my origin”
    All JavaScript code in the page, regardless of origin, has the same trust level and permissions
    If one bit of code fails or is compromised, the entire page/app/site can be compromised
    Quick Demo…
    Youtube
    Google News
    Error from Amazon
  • Circles of (Dis)Trust
    Shared Frameworks
    Affiliates
    Images
    Gadgets
    Maps
    You Tube
    Your Code
    Social Networks
    Analytics
    Search
    Content
    Display Ads
    Images
  • User’s Expectations ≠ Reality
    Mismatch between browser security and expectations
    O/S boundaries protected
    Cross-domain content protected
    Composite pages have a single policy
    Aggregation (mash-ups) not protected
    You need a composite policy for a composite page
    Let’s secure the cookie…
  • The growing risk…
    Differentiation between Cloud and Local Services is blurring…
    User Data being aggregated…
    Personal Data (both local and cloud-based)
    Storage, Photos, E-Mail, Social Network/ Contacts, IM
    Devices
    Phones, GPS, Camera, etc.
    …and exposed to…
    Site Services
    Rich Advertising, Analytics, Maps, Affiliate Programs
    Site Extensibility
    Gadgets, Libraries, etc.
  • What about IFrames?
    Still exploitable…
    Run-away code…
    Navigation…
    Click-Jacking…
    And not rich enough…
    Designed for content embedding
    Established fixed “policies”
    Won’t work for display integration (e.g., fly outs)
    Fails for tight integration w/ API’s, CSS
    Isolation model, not a Security Architecture
  • Web Sandbox
    Isolate and secure the boundaries via composite host-defined policies
    Builds on existing knowledge
    Embrace existing programming patterns
    Provides browser equalization
    Open Source Project (Apache License)
  • QoS - Going beyond security
    Profiles executing code
    Error tracking and recovery
    Code Throttling
    LifeCycle management
    QoS Demo…
  • Your Web Page
    Creating Secure Containers
    Policy and Rules
    Policy and Rules
    Policy and Rules
    Web Sandbox Virtual Machine
    Web Sandbox Virtual Machine
    Web Sandbox Virtual Machine
    Untrusted Script
    Untrusted Script
    Untrusted Script
  • Web Sandbox: The Big Picture
    Trusted Host(e.g., Your Site)
    Requests Content(untrusted)
    SandboxVirtual Machine(JavaScript Library)
    Sandboxed Execution
    Sandboxed Execution
    TransformationPipeline
    (Server or Client-based)
    Untrusted Content
    Virtualize Code
  • Transformation Process
    Request Resource
    Parse Resource
    Output JavaScript for execution within the Sandbox VM
    Let’s take a look….
  • Sandbox Virtual Machine
    Validates execution against policies
    Supports instancing and lifecycle
    Monitors QoS via profiling & throttling
    Protects external communication
  • Policies
    Contextually-aware API “tables”
    Allow/Deny/Augment rules
    Cascading model
    Default “Gadget” Policy
    Supports JavaScript/ W3C DOM
    Provides Namespace isolation
    Demo…
  • Trusted/ Untrusted boundaries
    Custom Policies to Surface Host APIs
    Demo…
    Mutually distrusted components sharing single “Trusted” Map
  • Simple Integration…
    <script src="sandbox2.js"></script>
    <div id="box"></div>
    <script src="transform.ashx?type=script&guid=GadgetGUID&ua=IE8&url=http://siteexperts.com/untrusted.js"></script>
    <script>var instance = new $Sandbox(document.getElementById("box"), $Policy.Gadget, 'GadgetGUID');instance.initialize();
    </script>
  • Closing Thoughts…
    Web Application ecosystem is evolving
    Applications getting richer via aggregation
    More valuable services and personal data are exposed
    The web security model must evolve
    Web-sandbox adds protection across the boundaries
    Sites can properly model and enforce the trust relationship
    Sites can protect themselves and their users
    Possible without redefining the web…
    Go play with it (http://websandbox.livelabs.com)
  • Questions?
    Learn more at:
    http://websandbox.livelabs.com
    Also don’t miss the panelSecure Mashups: Getting to Safe Web Plug-insWednesday, 10:55am